BILL NUMBER: SB 1386 CHAPTERED
BILL TEXT
CHAPTER 429
FILED WITH SECRETARY OF STATE SEPTEMBER 11, 1998
APPROVED BY GOVERNOR SEPTEMBER 11, 1998
PASSED THE SENATE AUGUST 19, 1998
PASSED THE ASSEMBLY AUGUST 17, 1998
AMENDED IN ASSEMBLY AUGUST 13, 1998
AMENDED IN ASSEMBLY AUGUST 10, 1998
AMENDED IN ASSEMBLY JULY 30, 1998
AMENDED IN ASSEMBLY JULY 27, 1998
AMENDED IN ASSEMBLY JULY 6, 1998
AMENDED IN ASSEMBLY JUNE 16, 1998
AMENDED IN SENATE APRIL 28, 1998
INTRODUCED BY Senator Leslie
(Principal coauthor: Assembly Member Runner)
(Coauthors: Assembly Members Alquist, Campbell, Goldsmith, House,
and Leach)
JANUARY 7, 1998
An act to amend Section 1798.16 of the Civil Code, to add Section
18030.5 to the Education Code, and to add Sections 6254.20, 6254.21,
and 11015.5 to the Government Code, relating to state computer
technology.
LEGISLATIVE COUNSEL'S DIGEST
SB 1386, Leslie. State computer technology: information
gathering.
(1) Existing law includes comprehensive provisions that govern
information technology in state government, including provisions that
establish the Department of Information Technology, prescribe the
duties of that department, and prescribe the responsibilities of
state agencies in the area of information technology.
This bill would require every state agency that utilizes any
method, device, identifier, or other data base application on the
Internet to electronically collect personal information about any
user, to prominently display specified information at at least one
anticipated initial point of communication with a potential user, as
specified, including notice to the user that he or she has the option
of having his or her personal information discarded without reuse or
distribution.
The bill would also prohibit a state agency from distributing or
selling any electronically collected personal information about
users, without the user's permission, to any 3rd party, except as
specified.
(2) The California Public Records Act sets forth specified
procedures for the disclosure of certain types of information by
state and local agencies.
This bill would prohibit any state or local agency from posting
the home address or telephone number of any elected or appointed
official on the Internet without first obtaining the written
permission of that individual.
(3) Under existing law, the State Librarian administers the
foundation program whereby state funds are made available to public
libraries for the purpose of providing services to the public.
This bill would impose a state-mandated local program by requiring
every public library that receives state funds pursuant to the
foundation program and that provides public access to the Internet to
adopt a policy by January 1, 2000, regarding access to the Internet
by minors and to make the policy available to members of the public.
(4) The California Constitution requires the state to reimburse
local agencies and school districts for certain costs mandated by the
state. Statutory provisions establish procedures for making that
reimbursement, including the creation of a State Mandates Claims Fund
to pay the costs of mandates that do not exceed $1,000,000 statewide
and other procedures for claims whose statewide costs exceed
$1,000,000.
This bill would provide that, if the Commission on State Mandates
determines that the bill contains costs mandated by the state,
reimbursement for those costs shall be made pursuant to these
statutory provisions.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Section 1798.16 of the Civil Code is amended to read:
1798.16. (a) Whenever an agency collects personal information,
the agency shall maintain the source or sources of the information,
unless the source is the data subject or he or she has received a
copy of the source document, including, but not limited to, the name
of any source who is an individual acting in his or her own private
or individual capacity. If the source is an agency, governmental
entity or other organization, such as a corporation or association,
this requirement can be met by maintaining the name of the agency,
governmental entity, or organization, as long as the smallest
reasonably identifiable unit of that agency, governmental entity, or
organization is named.
(b) Whenever an agency electronically collects personal
information, as defined by Section 11015.5 of the Government Code,
the agency shall retain the source or sources or any intermediate
form of the information, if either are created or possessed by the
agency, unless the source is the data subject that has requested that
the information be discarded or the data subject has received a copy
of the source document.
(c) The agency shall maintain the source or sources of the
information in a readily accessible form so as to be able to provide
it to the data subject when they inspect any record pursuant to
Section 1798.34. This section shall not apply if the source or
sources are exempt from disclosure under the provisions of this
chapter.
SEC. 2. Section 18030.5 is added to the Education Code, to read:
18030.5. (a) Every public library that receives state funds
pursuant to this chapter and that provides public access to the
Internet shall, by a majority vote of the governing board, adopt a
policy regarding access by minors to the Internet by January 1, 2000.
(b) Every public library that is required to adopt a policy
pursuant to subdivision (a) shall make the policy available to
members of the public at every library branch.
SEC. 3. Section 6254.20 is added to the Government Code, to read:
6254.20. Nothing in this chapter shall be construed to require
the disclosure of records that relate to electronically collected
personal information, as defined by Section 11015.5, received,
collected, or compiled by a state agency.
SEC. 4. Section 6254.21 is added to the Government Code, to read:
6254.21. (a) No state or local agency shall post the home address
or telephone number of any elected or appointed official on the
Internet without first obtaining the written permission of that
individual.
(b) For purposes of this section "elected or appointed official"
includes, but is not limited to, all of the following:
(1) State constitutional officers.
(2) Members of the Legislature.
(3) Judges and court commissioners.
(4) District attorneys.
(5) Public defenders.
(6) Members of a city council.
(7) Members of a board of supervisors.
(8) Appointees of the Governor.
(9) Appointees of the Legislature.
(10) Mayors.
(11) City attorneys.
(12) Police chiefs and sheriffs.
SEC. 5. Section 11015.5 is added to the Government Code, to read:
11015.5. (a) Every state agency, including the California State
University, that utilizes any method, device, identifier, or other
data base application on the Internet to electronically collect
personal information, as defined in subdivision (d), regarding any
user shall prominently display the following at at least one
anticipated initial point of communication with a potential user, to
be determined by each agency, and in instances when the specified
information would be collected:
(1) Notice to the user of the usage or existence of the
information gathering method, device, identifier, or other data base
application.
(2) Notice to the user of the type of personal information that is
being collected and the purpose for which the collected information
will be used.
(3) Notice to the user of the length of time that the information
gathering device, identifier, or other data base application will
exist in the user's hard drive, if applicable.
(4) Notice to the user that he or she has the option of having his
or her personal information discarded without reuse or distribution,
provided that the appropriate agency official or employee is
contacted after notice is given to the user.
(5) Notice to the user that any information acquired by the state
agency, including the California State University, is subject to the
limitations set forth in the Information Practices Act of 1977 (Title
1.8 (commencing with Section 1798) of Part 4 of Division 3 of the
Civil Code).
(6) Notice to the user that state agencies shall not distribute or
sell any electronically collected personal information, as defined
in subdivision (d), about users to any third party without the
permission of the user.
(7) Notice to the user that electronically collected personal
information, as defined in subdivision (d), is exempt from requests
made pursuant to the California Public Records Act (Chapter 3.5
(commencing with Section 6250) of Division 7 of Title 1).
(8) The title, business address, telephone number, and electronic
mail address, if applicable, of the agency official who is
responsible for records requests, as specified by subdivision (b) of
Section 1798.17 of the Civil Code, or the agency employee designated
pursuant to Section 1798.22 of that code, as determined by the
agency, who is responsible for ensuring that the agency complies with
requests made pursuant to this section.
(b) A state agency shall not distribute or sell any electronically
collected personal information about users to any third party
without prior written permission from the user, except as required to
investigate possible violations of Section 502 of the Penal Code or
as authorized under the Information Practices Act of 1977 (Title 1.8
(commencing with Section 1798) of Part 4 of Division 3 of the Civil
Code). Nothing in this subdivision shall be construed to prohibit a
state agency from distributing electronically collected personal
information to another state agency or to a public law enforcement
organization in any case where the security of a network operated by
a state agency and exposed directly to the Internet has been, or is
suspected of having been, breached.
(c) A state agency shall discard without reuse or distribution any
electronically collected personal information, as defined in
subdivision (d), upon request by the user.
(d) For purposes of this section:
(1) "Electronically collected personal information" means any
information that is maintained by an agency that identifies or
describes an individual user, including, but not limited to, his or
her name, social security number, physical description, home address,
home telephone number, education, financial matters, medical or
employment history, password, electronic mail address, and
information that reveals any network location or identity, but
excludes any information manually submitted to a state agency by a
user, whether electronically or in written form, and information on
or relating to individuals who are users serving in a business
capacity, including, but not limited to, business owners, officers,
or principals of that business.
(2) "User" means an individual who communicates with a state
agency or with an agency employee or official electronically.
(e) Nothing in this section shall be construed to permit an agency
to act in a manner inconsistent with the standards and limitations
adopted pursuant to the California Public Records Act (Chapter 3.5
(commencing with Section 6250) of Division 7 of Title 1) or the
Information Practices Act of 1977 (Title 1.8 (commencing with Section
1798) of Part 4 of Division 3 of the Civil Code).
SEC. 6. Notwithstanding Section 17610 of the Government Code, if
the Commission on State Mandates determines that this act contains
costs mandated by the state, reimbursement to local agencies and
school districts for those costs shall be made pursuant to Part 7
(commencing with Section 17500) of Division 4 of Title 2 of the
Government Code. If the statewide cost of the claim for
reimbursement does not exceed one million dollars ($1,000,000),
reimbursement shall be made from the State Mandates Claims Fund.
Notwithstanding Section 17580 of the Government Code, unless
otherwise specified, the provisions of this act shall become
operative on the same date that the act takes effect pursuant to the
California Constitution.